# StormFetch Features and Roadmap

Version: `1.16.3`  
Developer: Pradeep Kumar Sheoran (Stack Developer)  
Company: BSG Technologies  
Contact: +91-8595147850 (Also WhatsApp)  
Official website: [Visit BSG Technologies](https://bsgtechnologies.com)

## Advanced Feature Index for npm

StormFetch is designed as an advanced typed HTTP client with these built-in capabilities:

| Area | Included features |
| --- | --- |
| HTTP methods | `request`, `fetch`, `get`, `post`, `put`, `patch`, `delete`, `head`, `options`, `query`, uppercase aliases |
| API styles | JSON, form URL encoded, multipart, GraphQL, batch, polling, REST resource builder, typed contract builder |
| React support | React DOM and React Native hook factory, query, lazy query, mutation, infinite query |
| React Native | Dedicated entry point, RN file descriptor, async token provider, async cache storage, injected file saver |
| Cache | TTL cache, cache tags, stale refresh, prefetch, hydrate, dehydrate, key inspection, async storage |
| Reliability | Retry policies, dedupe, priority queue, concurrency limits, offline queue, circuit breaker |
| Debugging | Request history, replay, curl export, HAR export, structured events |
| Content parsing | HTML/XML fetch, DOM parsing, CSS selector scraping, meta/link/image/json-ld extraction |
| Streaming | Text streams, JSON streams, NDJSON streams, Server-Sent Events |
| Testing | Mock adapter, scenario mock server, request inspection, reliability smoke tests, security smoke tests, CI matrix |
| Security | XSRF, basic auth, bearer auth, allowed/blocked hosts, CIDR/DNS guards, metadata blocking, path traversal guard, HTTPS guard, private-network blocking, redacted debug exports, no-proxy handling, redirect credential controls, HMAC signing, secure logger |
| SSR/Node | Server client with cookie/header forwarding, Node HTTP/1.1 and HTTP/2 adapters, proxy/redirect/body limits |
| Extensibility | Plugins, interceptors, custom adapters, custom DOM parser, schema validators |
| Learning and discovery | Boxed Learn Here lessons, complete functions directory, task selection guide, examples/output/errors/use cases, FAQ |
| Package identity | Frozen `STORMFETCH_PACKAGE_INFO` code signature with official developer/company/contact/website |

## Old and New Feature List

This list is written for package users who want to understand the complete feature depth before installing.

| Stage | User-visible features |
| --- | --- |
| Foundation | TypeScript client, `baseURL`, timeout, JSON parsing, auth token provider, request/response interceptors, normalized errors |
| Cross-platform | Browser Fetch, browser XHR, Node adapter, SSR-safe runtime checks, React Native/Expo entry point |
| Request helpers | `request`, `fetch`, `get`, `post`, `put`, `patch`, `delete`, `head`, `options`, uppercase aliases |
| Body helpers | JSON, URL-encoded form, multipart form, browser file upload, React Native file descriptor |
| API patterns | GraphQL helper, batch calls, polling, REST `resource`, typed `contract`, endpoint-map typing |
| React usage | `useStormQuery`, `useLazyStormQuery`, `useStormMutation`, `useStormInfiniteQuery` |
| Cache and state | TTL cache, async cache storage, cache tags, stale refresh, prefetch, hydrate/dehydrate, key inspection, subscriptions |
| Reliability | cancellation, retries, safe retry policy, dedupe, priority queue, concurrency limits, offline queue, circuit breaker |
| Debugging | request IDs, duration tracking, request history, replay, curl export, HAR export, structured events |
| Content and streams | HTML/XML fetch, DOM parsing, scraping, metadata/link/image/json-ld extraction, text/JSON/NDJSON/SSE streams |
| Test tooling | mock adapter, scenario mock server, custom error factory, interceptor manager |
| Security baseline | XSRF, basic auth, bearer auth, unsafe retry opt-in, response validation, max body/content length |
| Security policy | host allow/block, wildcard/RegExp/function matchers, method allowlist, protocol allowlist, absolute URL guard, path traversal guard |
| SSRF protection | private-network blocking, cloud metadata blocking, CIDR allow/block, DNS validation hook, custom IP resolver |
| Credential safety | same-origin XSRF, credential forwarding policy, redirect credential stripping, sensitive header redaction |
| Payload safety | JSON request caps, JSON response caps, query depth cap, strict query encoding mode, decompression-ratio guard, parse reviver |
| Node transport safety | HTTP/2 adapter, native FormData serialization, stream upload/response support, gzip/deflate/br/zstd decompression, HTTPS proxy CONNECT, custom agents, normalized `NO_PROXY`, proxy env opt-in, socket path allowlist, FormData header policy |
| TLS safety | custom CA, client cert/key, SNI, certificate validation control, SHA-256 certificate pinning |
| Security plugins | HMAC signing plugin, secure logger plugin, security rate-limit signal plugin |
| Supply-chain safety | security smoke tests, threat model, release checklist, denylist, zizmor, CodeQL, Semgrep, dependency review, SBOM, OIDC provenance publish workflow |

## Available Now

### Cross-platform core

- ReactJS, React Native, Expo, browser, Node.js 18+, Deno, Bun, and SSR support.
- Dedicated `stormfetch/react-native` package entry.
- React Native detection before Node process-shim detection.
- Fetch, browser XHR, Node HTTP/1.1, Node HTTP/2, and mock adapters.
- ESM, CommonJS, source maps, and TypeScript declarations.
- No external runtime dependency.

### Requests and typing

- Typed `request`, `fetch`, `get`, `post`, `put`, `patch`, `delete`, `head`, `options`, and `query` methods.
- Uppercase HTTP aliases: `GET`, `POST`, `PUT`, `PATCH`, `DELETE`, `HEAD`, `OPTIONS`, and `QUERY`.
- JSON, URL-encoded form, multipart, GraphQL, batch, polling, and REST resource helpers.
- Typed endpoint-map client.
- Query parameters, nested serialization, and path parameters.
- JSON, text, Blob, ArrayBuffer, and raw Response modes.
- Request/response transformers and validation status controls.
- Runtime request/response schema validation through user-provided functions or parser-like objects.
- Request IDs and duration measurement.
- Conditional, one-shot, and prepended request/response/error interceptors.
- Bounded nested form serialization with circular-reference and prototype-shaped-key protection.

### Reliability

- AbortController cancellation and timeout handling.
- Buffered and streaming body/content caps across Fetch, XHR, and Node adapters.
- Stable network codes including `ECONNREFUSED`, `ECONNRESET`, and `ENOTFOUND`.
- External AbortController cancellation is reported as an abort error, not a network error.
- Exponential retry with `network-only`, `safe`, and `aggressive` policies.
- Explicit unsafe-method retry opt-in.
- In-flight GET deduplication.
- TTL GET cache with memory, browser storage, synchronous custom storage, or async native storage.
- Cache tags, async invalidation, stale time, and stale-while-revalidate.
- Smart cache manager with prefetch, hydrate, dehydrate, key inspection, and subscriptions.
- Rate-spaced, priority-aware request queue with global and per-host concurrency limits.
- Route policy engine for per-endpoint defaults.
- Circuit breaker with open, half-open, recovery threshold, and fallback response support.
- Request history, replay, curl export, and HAR export.
- Streaming helpers for text, JSON, NDJSON, and Server-Sent Events.
- In-memory offline queue with injectable native online-state provider.
- Body/content limits, redirect method rewriting, `beforeRedirect`, HTTPS proxy CONNECT, custom agents, normalized `NO_PROXY`, and decompression options for Node.

### Authentication and errors

- Async bearer-token provider.
- One-time refresh-token flow after authenticated 401 responses with request locking.
- Basic authentication, XSRF, language headers, and unauthorized callback.
- Request, response, and error interceptors.
- Auth, language, and logger plugins.
- Normalized errors with code, field errors, trace ID, raw data, and network/timeout/abort flags.

### React and files

- Dependency-free React hook factory for React DOM and React Native.
- Query, lazy query, mutation, and infinite query hooks.
- Mutation invalidation callbacks and optimistic data updates.
- Browser, Node, and React Native multipart FormData support.
- Typed React Native `{ uri, name, type }` file descriptor.
- Browser Blob saving and injected native file saver.
- Browser XHR upload/download progress and Node chunked upload/download progress callbacks where supported.
- HTML/XML fetching, DOM parsing, selector scraping, meta/link/image/json-ld extraction helpers.

### Testing, security, and observability

- Mock adapter for unit tests, storybooks, and offline demos.
- Mock server mode with scenarios, route mutation, and request inspection.
- Security guard with allowed hosts, blocked hosts, CIDR policy, DNS rebinding checks, HTTP/HTTPS policy, method allowlists, private-network blocking, cloud metadata blocking, URL length caps, request signing, and custom guard hooks.
- Absolute URL override and `..` path traversal guards for hardened `baseURL` clients.
- Default 10MB body/content caps, with `-1` for explicit unlimited mode.
- JSON request/response depth/key caps, custom JSON reviver, decompression-ratio guard, and nested query depth caps.
- Strict RFC3986 query encoding mode.
- Node FormData header policy defaults to `content-only`.
- Socket paths are blocked unless explicitly allowlisted.
- Node TLS/mTLS options and certificate pinning.
- HMAC request signing, secure logging, and suspicious auth-status burst detection plugins.
- Sensitive request/response headers, URL credentials, query secrets, and body token patterns are redacted from public history, curl export, and HAR export by default.
- Per-header credential forwarding policies for bearer tokens, cookies, API keys, and custom secret headers.
- Cross-origin Node redirects strip credential headers before following.
- `SECURITY.md`, `THREATMODEL.md`, `RELEASE_SECURITY.md`, `SECURITY_DENYLIST.md`, GitHub Actions security scan with zizmor, CodeQL, Semgrep, dependency review, SBOM generation, and npm OIDC/provenance publish workflow are included.
- Structured request/cache/security events through `subscribe()` and `observability.onEvent`.
- SSR server client helper with cookie/header forwarding.
- Contract builder for SDK-like endpoint functions.

## Completed in 1.14

- Focused `core`, `react`, `node`, `dom`, `mock`, `security`, `openapi`, `observability`, and `devtools` entry points.
- Durable offline mutation storage, exponential retry scheduling, idempotency keys, conflict resolution, dead-letter persistence, retry, discard, and inspection APIs.
- Promise-based and controllable native transfer contracts for injected Android, iOS, or Expo implementations.
- OpenTelemetry-compatible spans, trace headers, event metrics, and request-duration metrics without a runtime dependency.
- Deterministic OpenAPI SDK generator CLI with watch mode and tag grouping.
- Headless DevTools snapshots plus a dependency-free mounted request/cache inspector.
- ESM/CommonJS packed-consumer checks, React Native contract tests, browser matrix, Deno/Bun runtime workflows, and performance budget.
- npm metadata, provenance publishing, changelog, migration guide, and API stability policy.

## Next Release Candidates

- Official example adapters for popular Android/iOS background-transfer modules; platform dependencies remain consumer-controlled.
- DevTools filtering, request comparison, export/import, and standalone browser extension.
- OpenAPI parameter/schema expansion and incremental generation cache.
- Persisted offline payload encryption using a consumer-supplied crypto provider.

## Future

- QUIC/HTTP/3 when stable cross-runtime primitives are available.
- Distributed circuit-breaker state through an injected coordination store.
- Optional schema-codec adapters while keeping the StormFetch runtime dependency-free.